What is claimed is : 

1. A method for evaluating security executed to a system 
constituted by at least one component, by the use of an 
electronic computer, the method comprising steps of: 

a first step of accepting a first specification of a 
system to be evaluated and a second specification of each 
of the components constituting the system, from an operator 
via an input unit connected to the electronic computer; 

a second step of retrieving data from a database in 
which" constituent components and security countermeasures 
to be executed to the constituent components are described 
for each of system types, and of reading out security 
countermeasures to be executed to the components 
constituting the system to be evaluated which are specified 
by the second specification, out of the constituent 
components of the system type, the system type 
corresponding to that of the system to be evaluated which 
is specified by the first specification; 

a third step of displaying on a display unit 
connected to the electronic computer, the security 
countermeasures read out in the second step in 
correspondence with each of the components constituting the 
system to be evaluated which are specified by the second 
specification and of accepting from the operator via the 
input unit, information whether or not each of the security 
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2 5 count ermeasures being displayed is executed; and 

26 a fourth step of evaluating a state of security of 

2 7 the system to be evaluated, based on the information that 

28 the security countermeasures of the components constituting 

29 the system to be_ev^=«^rted^ax^ 

30 information being accepted in the third step, and of 

31 displaying evaluation results on the display unit. 

1 2. A method for evaluating security as claimed in claim 1, 

2 wherein 

£j 3 the database describes, as to each of the. security 

rU 4 countermeasures, a security type ensured by executing the 

M; 5 security countermeasure concerned, and wherein 

03 6 the fourth step includes steps of: 

O 7 classifying the security countermeasures , which are 

fU 8 read out in the second step, into the security types; 

Q 9 determining, as to each of the security types, the 

10 ratio of the number of security countermeasures accepted as 

11 executed in the third step, to the number of security 

12 countermeasures classified into the security type 

13 concerned; and 

14 displaying on the display unit the ratio for each of 

15 the security types as the degree of accomplishment of the 

16 security countermeasures classified into the security type 

17 concerned. 
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1 3. A method for evaluating security as claimed in claim 1, 

2 wherein 

3 the database describes , as to each of the security 

4 countermeasures, a security type ensured and the degree of 

5 risk avoided, by executing the security countermeasure 

6 concerned, and wherein 

7 the fourth step includes steps of; 

8 classifying the security countermeasures, which are 

9 read out in the second step, into the security types; 

10 determining, as to each of the security types, the 

11 total" sum of the degrees of risks corresponding to the 

12 security countermeasures accepted as non-executed in the 

13 third step, out of the security countermeasures classified 

14 into the security type concerned; and displaying on the 

15 display unit the total sum of the degrees of risks for each 

16 of the security types as the degree of the remaining risk 

17 of the security countermeasures classified into the 

18 respective security types. 

1 4. A method for evaluating security as claimed in claim 1, 

2 wherein 

3 the database describes, as to each of the security 

4 countermeasures, a security type ensured and a cost 

5 required, by executing the security countermeasure 

6 concerned, and wherein 

7 the fourth step includes steps of: 
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8 classifying the security countermeasures , which are 

9 read out in the second step, into the security types; 

10 determining, as to each of the security types, the 

11 total sum of the costs corresponding to the security 

12 countermeasures accepted as executed in the third step, out 

13 of the security countermeasures classified into the 

14 security type concerned; and displaying on the display 

15 unit, the total sum of the costs for each of the security 

16 types as the required cost of the security countermeasures 

17 classified into the security type concerned. 

1 5. A method for evaluating security as claimed in claim 1, 

2 wherein 

3 the database describes , as to each of the security 

4 countermeasures, a security level ensured by executing the 

5 security countermeasure concerned, and wherein 

6 the first step includes a step of accepting from the 

7 operator via the input unit, a third specification of the 

8 security level of the system to be evaluated in addition to 

9 the first specification of the system to be evaluated and 

10 the second specification of the components constituting the 

11 system, and wherein 

12 the second step includes a step of reading out from 

13 the database, the security countermeasures to be executed 

14 to components constituting the system to be evaluated, 

15 which are specified by the second specification, out of the 
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16 constituent components of the system type corresponding to 

17 that of the system which is specified by the first 

18 specification, each of the security countermeasures having 

19 a level not higher than the security level specified by the 

20 third specification. 

1 6. A method for evaluating security as claimed in claim 1, 

2 wherein 

3 the first step includes, 

4 steps of reading out all of the system types 

5 described in the database, displaying them on the display 

6 unit, and accepting from the operator via the input unit a 

7 specification of any one of the system types being 

8 displayed, as the first specification of the system to be 

9 evaluated, and 

10 steps of reading out from the database all of the 

11 constituent components of the system type specified by the 

12 first specification, displaying them on the display unit, 

13 and accepting from the operator via the input unit, 

14 information whether or not each of the constituent 

15 components being displayed is used in the system to be 

16 evaluated, as the second specification of each of the 

17 components constituting the system to be evaluated. 

1 7 . A storage medium in which a program for making an 

2 electronic computer evaluate security of a system 
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3 constituted by at least one component is stored, the 

4 program making the electronic computer execute steps of: 

5 a first step of accepting a first specification of a 

6 system to be evaluated and a second specification of each 

7 of the components constituting the system, from an operator 

8 via an input unit connected to the electronic computer; 

9 a second step of retrieving data from a database in 

10 which constituent components and security countermeasures 

11 to be executed to the constituent components are described 

12 for each of system types, and of reading out security 

13 countermeasures to be executed to the components 

14 constituting the system to be evaluated which are specified 

15 by the second specification, out of the constituent 

16 components of the system type, the system type 

17 corresponding to that of the system to be evaluated which 

18 is specified by the first specification; 

19 a third step of displaying on a display unit 

20 connected to the electronic computer, the security 

21 countermeasures read out in the second step in 

22 correspondence with each of the components constituting the 

23 system to be evaluated which are specified by the second 

24 specification and of accepting from the operator via the 

25 input unit information whether or not each of the security 
2 6 countermeasures being displayed is executed; and 

27 a fourth step of evaluating a state of security of 

28 the system to be evaluated, based on the information that 
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29 the security countermeasures to the components constituting 

30 the system to be evaluated are executed or not, the 

31 information being accepted in the third step, and of 

32 displaying evaluation results on the display unit. 

1 8. A program for making an electronic computer evaluate 

2 security of a system constituted by at least one component, 

3 the program making the electronic computer execute steps 

4 Of: 

5 a first step of accepting a first specification of a 

6 system to be evaluated and a second specification of each 

7 of the components constituting the system, from an operator 

8 via an input unit connected to the electronic computer; 

9 a second step of retrieving data from a database in 

10 which constituent components and security countermeasures 

11 to be executed to the constituent components are described 

12 for each of system types, and of reading out security 

13 countermeasures to be executed to the components 

14 constituting the system to be evaluated which are specified 

15 by the second specification, out of the constituent 

16 components of the system type, the system type 

17 corresponding to that of the system to be evaluated which 

18 is specified by the first specification; 

19 a third step of displaying on a display unit 

20 connected to the electronic computer, the security 

21 countermeasures read out in the second step in 
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22 correspondence with each of the components constituting the 

23 system to be evaluated which are by the second 

24 specification, and of accepting from the operator via the 

25 input unit, information whether or not each of the security 

26 countermeasures is executed; and 

27 a fourth step of evaluating a state of security of 

28 the system to be evaluated, based on the information that 

29 the security countermeasures to the components constituting 

30 the system to be evaluated are executed or not, the 

31 information being accepted in the third step, and of 

32 displaying evaluation results on the display unit. 

1 9. A security evaluation apparatus for evaluating security 

2 executed to a system constituted by at least one component, 

3 comprising: 

4 a database in which constituent components and 

5 security countermeasures to be executed to the constituent 

6 components are described for each of system types; 

7 a first specification accepting unit for reading out 

8 and displaying all of the system types described in the 

9 database and accepting a specification of any one of the 

10 system types being displayed, as a first specification of a 

11 system to be evaluated from an operator; 

12 a second specification accepting unit for reading out 

13 from the database and displaying all of the constituent 

14 components of the system type specified by the first 
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15 specification, and for accepting from the operator 

16 information whether or not each of the constituent 

17 components being displayed is used in the system to be 

18 evaluated, as a second specification of each of the 

19 components constituting the system to be evaluated; 

20 a third specification accepting unit for reading out 

21 from the database and displaying the security 

22 countermeasures to be executed to the constituent 

23 components specified by the second specification, out of 

24 the constituent components of the system types specified by 

25 the first specification, and for accepting from the 

26 operator information whether or not each of the security 
2 7 countermeasures being displayed is executed; and 

28 an evaluation unit for evaluating a state of security 

29 of the system to be evaluated, based on the information 

30 that the security countermeasures of the constituent 

31 components are executed or not, the information being 

32 accepted by the third specification accepting unit, and for 

33 displaying evaluation results of the state of security. 

1 10. A method for supporting making of security 

2 countermeasures to be executed to a system constituted by 

3 at least one component by the use of an electronic 

4 computer, comprising steps of: 

5 a first step of accepting a first specification of a 

6 system to be supported and a second specification of each 
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7 of the components constituting the system, from an operator 

8 via an input unit connected to the electronic computer; 

9 a second step of retrieving data from a database in 

10 which constituent components and security counter-measures 

11 to be executed to the constituent components are described 

12 for each of system types and of reading out the security 

13 countermeasures to be executed to the components 

14 constituting the system to be supported which are specified 

15 by the second specification, out of the constituent 

16 components of the system type, the system type 

17 corresponding to that of the system to be supported which 

18 is specified by the first specification; and 

19 a third step of displaying on a display unit 

20 connected to the electronic computer, the security 

21 countermeasures read out in the second step in 

22 correspondence with each of the components constituting the 
2 3 system to be supported which are specified by the second 

24 specification. 

1 11. A method for supporting the making of security 

2 countermeasures as claimed in claim 10, wherein 

3 the database describes, as to each of the security 

4 countermeasures , a security type ensured by executing each 

5 of the security countermeasure concerned, and wherein 
; 6 the second step reads out from the database, the 

7 security countermeasures and their security types for each 
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8 of the components constituting the system to be supported 

9 which are specified by the second specification, out of the 

10 constituent components of the system type corresponding to 

11 that of the system to be supported which is specified by 

12 the first specification, and wherein 

13 the third step displays on the display unit the 

14 security count ermeasures and their security types which are 

15 read out in the second step in correspondence with each of 

16 the components constituting the system to be supported 

17 which are specified in the second specification. 

1 12. A method for supporting making of security 

2 countermeasures as claimed in claim 10, wherein 

3 the database describes, as to each of the security 

4 countermeasures, a security level ensured by executing the 

5 security count ermeasure concerned, and wherein 

6 the first step accepts from the operator via the 

7 input unit a third specification of the security level to 

8 be applied to the system to be supported in addition to the 

9 first specification of the system to be supported and the 

10 second specification of the components constituting the 

11 system, and wherein 

12 the second step reads out from the database the 

13 security countermeasures to be executed to the components 

14 constituting the system to be supported which are specified 

15 by the second specification, out of the constituent 
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16 components of the system type corresponding to that of the 

17 system to be supported which is specified by the first 

18 specification, each of the security countermeasures having 

19 a level not higher than the security level specified by the 

20 third specification. 

1 13. A method for supporting making of security 

2 countermeasures as claimed in claim 10 , wherein 

3 the first step includes, 

4 steps of reading out all of the system types 

5 described in the database, displaying them on .the display 

6 unit, and accepting from the operator via the input unit a 

7 specification of any one of the system types being 

8 displayed as the first specification of a system to be 

9 supported, and 

10 steps of reading out from the database all of the 

11 constituent components of the system type specified by the 

12 first specification, displaying them on the display unit, 

13 and accepting from the operator via the input unit whether 

14 or not each of the constituent components being displayed 

15 is used in the system to be supported, as the second 

16 specification of the components constituting the system to 

17 be supported. 

1 14. A storage medium in which a program for making an 

2 electronic computer support making of security 
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countermeasures to be executed to a system constituted by 
at least one component is stored, the program making the 
electronic computer execute steps of: 

a first step of accepting a first specification of a 
system to be supported and a second specification of each 
of the components constituting the system, from an operator 
via an input unit connected to the electronic computer; 

a second step of retrieving data from a database in 
which constituent components and security countermeasures 
to be executed to the constituent components are described 
for each of system types and of reading out security 
countermeasures to be executed to the components 
constituting the system to be supported which are specified 
by the second specification, out of the constituent 
components of the system type, the system type 
corresponding to that of the system to be supported which 
is specified by the first specification; and 

a third step of displaying on a display unit 
connected to the electronic computer, the security 
countermeasures read out in the second step in 
correspondence with each of the components constituting the 
system to be supported which are specified by the second 
specification . 

15. A program for making an electronic computer support 
making of security countermeasures to be executed to a 
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system constituted by at least one component, the program 
making the electronic computer execute steps of: 

a first step of accepting a first specification of a 
system to be supported and a second specification of each 
of the components constituting the system, from an operator 
via an input unit connected to the electronic computer; 

a second step of retrieving data from a database in 
which constituent components and security countermeasures 
to be executed to the constituent components are described 
for each of system types and of reading out security 
countermeasures to be executed to the components 
constituting the system to be supported which are specified 
by the second specification, out of the constituent 
components of the system type, the system type 
corresponding to that of the system to be supported which 
is specified by the first specification; and 

a third step of displaying on a display unit 
connected to the electronic computer, the security 
countermeasures read out in the second step in 
correspondence with each of the components constituting the 
system to be supported which are specified by the second 
specification. 

16. A security construction support apparatus for 
supporting making of security countermeasures to be 
executed to a system constituted by at least one component, 
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4 comprising: 

5 a database in which constituent components and 

6 security counter-measures to be executed to the constituent 

7 components are described for each of system types; 

8 a first specification accepting unit for reading out 

9 all of system types described in the database to display 

10 them and accepting from an operator a specification of any 

11 one of the system types being displayed as a first 

12 specification of a system to be supported; 

13 a second specification accepting unit for reading out 
J3 14 from the database and displaying all of the constituent 

ry 15 components of the system type specified by the first 

16 specification, and for accepting from an operator whether 

JO 17 or not each of the constituent components being displayed 

q 18 is used in the system to be supported as a second 

fU 19 specification of each of the components constituting the 

q 20 system to be supported; and 

" 21 a security countermeasure display unit for reading 

22 out from the database the security countermeasures to be 

23 executed to the constituent components specified by the 

24 second specification accepting unit, out of the constituent 

25 components of the system type specified by the first 

26 specification accepting unit, and for displaying them. 
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